Announcing OSV-Scanner V2: Vulnerability scanner and remediation tool for open source

Posted by Rex Pan and Xueqin Cui, Google Open Source Security Team


In December 2022, we released the open source OSV-Scanner tool, and earlier this year, we open sourced OSV-SCALIBR. OSV-Scanner and OSV-SCALIBR, together with OSV.dev are components of an open platform for managing vulnerability metadata and enabling simple and accurate matching and remediation of known vulnerabilities. Our goal is to simplify and streamline vulnerability management for developers and security teams alike.

Today, we're thrilled to announce the launch of OSV-Scanner V2.0.0, following the announcement of the beta version. This V2 release builds upon the foundation we laid with OSV-SCALIBR and adds significant new capabilities to OSV-Scanner, making it a comprehensive vulnerability scanner and remediation tool with broad support for formats and ecosystems. 



What’s new

Enhanced Dependency Extraction with OSV-SCALIBR

This release represents the first major integration of OSV-SCALIBR features into OSV-Scanner, which is now the official command-line code and container scanning tool for the OSV-SCALIBR library. This integration also expanded our support for the kinds of dependencies we can extract from projects and containers:

Source manifests and lockfiles:

  • .NET: deps.json

  • Python: uv.lock

  • JavaScript: bun.lock

  • Haskell: cabal.project.freeze, stack.yaml.lock

Artifacts:

  • Node modules

  • Python wheels

  • Java uber jars

  • Go binaries


Layer and base image-aware container scanning

Previously, OSV-Scanner focused on scanning of source repositories and language package manifests and lockfiles. OSV-Scanner V2 adds support for comprehensive, layer-aware scanning for Debian, Ubuntu, and Alpine container images. OSV-Scanner can now analyze container images to provide:


  • Layers where a package was first introduced

  • Layer history and commands

  • Base images the image is based on (leveraging a new experimental API provided by deps.dev).

  • OS/Distro the container is running on

  • Filtering of vulnerabilities that are unlikely to impact your container image



This layer analysis currently supports the following OSes and languages:


Distro Support:

  • Alpine OS

  • Debian

  • Ubuntu


Language Artifacts Support:

  • Go

  • Java

  • Node

  • Python



Interactive HTML output

Presenting vulnerability scan information in a clear and actionable way is difficult, particularly in the context of container scanning. To address this, we built a new interactive local HTML output format. This provides more interactivity and information compared to terminal only outputs, including:

  • Severity breakdown

  • Package and ID filtering

  • Vulnerability importance filtering

  • Full vulnerability advisory entries



And additionally for container image scanning:

  • Layer filtering

  • Image layer information

  • Base image identification


Illustration of HTML output for container image scanning


Guided remediation for Maven pom.xml

Last year we released a feature called guided remediation for npm, which streamlines vulnerability management by intelligently suggesting prioritized, targeted upgrades and offering flexible strategies. This ultimately maximizes security improvements while minimizing disruption. We have now expanded this feature to Java through support for Maven pom.xml.

With guided remediation support for Maven, you can remediate vulnerabilities in both direct and transitive dependencies through direct version updates or overriding versions through dependency management.


We’ve introduced a few new things for our Maven support:

  • A new remediation strategy override.

  • Support for reading and writing pom.xml files, including writing changes to local parent pom files. We leverage OSV-Scalibr for Maven transitive dependency extraction.

  • A private registry can be specified to fetch Maven metadata.

  • A new experimental subcommend to update all your dependencies in pom.xml to the latest version.


We also introduced machine readable output for guided remediation that makes it easier to integrate guided remediation into your workflow.


What’s next?

We have exciting plans for the remainder of the year, including:

  • Continued OSV-SCALIBR Convergence: We will continue to converge OSV-Scanner and OSV-SCALIBR to bring OSV-SCALIBR’s functionality to OSV-Scanner’s CLI interface.

  • Expanded Ecosystem Support: We'll expand the number of ecosystems we support across all the features currently in OSV-Scanner, including more languages for guided remediation, OS advisories for container scanning, and more general lockfile support for source code scanning.

  • Full Filesystem Accountability for Containers: Another goal of osv-scanner is to give you the ability to know and account for every single file on your container image, including sideloaded binaries downloaded from the internet.

  • Reachability Analysis: We're working on integrating reachability analysis to provide deeper insights into the potential impact of vulnerabilities.

  • VEX Support: We're planning to add support for Vulnerability Exchange (VEX) to facilitate better communication and collaboration around vulnerability information.


Try OSV-Scanner V2

You can try V2.0.0 and contribute to its ongoing development by checking out OSV-Scanner or the OSV-SCALIBR repository. We welcome your feedback and contributions as we continue to improve the platform and make vulnerability management easier for everyone.

If you have any questions or if you would like to contribute, don't hesitate to reach out to us at [email protected], or post an issue in our issue tracker.

Introducing a new building block that summarizes content with Gemini in Google Docs

What’s changing

Last year, we introduced a collection of building blocks designed to help you manage important business workflows in Google Docs, including team task management, project tracking, hiring, and more. 

Today, we’re excited to announce an additional building block that adds an AI-generated summary to your content using Gemini in Docs. By going to Insert > Building Blocks > AI Summary or typing “@” followed by “AI summary,” Gemini will provide a summary that you can instantly insert or edit alongside other document collaborators. In addition, you can select the refresh option to update your summary when you make changes to your document. doc content. 

These AI-generated summaries make it easier to consume long documents and can be particularly useful for content such as technical documents, meeting notes, strategy documents, marketing briefs, and more. 
new building block that summarizes content with Gemini in Google Docs




Getting started 


Rollout pace 


Availability 

Available for Google Workspace: 
  • Business Standard and Plus 
  • Enterprise Standard and Plus 
  • Google One AI Premium 

Anyone who previously purchased these add-ons will also receive this feature: 
  • Gemini Business* 
  • Gemini Enterprise* 
*As of January 15, 2025, we’re no longer offering the Gemini Business and Gemini Enterprise add-ons for sale. Please refer to this announcement for more details.

Resources 

Available in beta: Convert your client-side encrypted documents after a Vault or Takeout export

What’s changing 

After a Vault or Data export (takeout), admins can now convert their exported client-side encrypted documents to Word files. This allows organizations to maintain ownership over, access to, and analysis of sensitive data in a portable format even after it has been exported from Google Workspace. 


Eligible Google Workspace admins can use this form to request access to the beta. We’ll share more specific instructions once you’re accepted into the beta.



Getting started

  • Admins: Client-side encryption can be enabled at the domain, OU, and Group levels (Admin console > Data > Compliance > Client-side encryption). Visit our Help Center to learn more about client-side encryption.

Rollout pace

  • The feature will be available immediately once you're accepted into the beta.

Availability

  • Available to Google Workspace Enterprise Plus, Education Standard and Education Plus customers.

Resources


Upcoming changes to how retention policies are applied to 1:1 direct messages in Google Chat

What’s happening 

Many Google Workspace organizations rely on Google Chat to facilitate communication and collaboration, including with users in the same domain, users in other Workspace Domains, and users with personal Google accounts. Currently, each organization in an external 1:1 direct message conversation can set their own retention policy, which impacts what messages end users see in the product user interface and what admins see in Google Vault.


To provide a more consistent product experience across conversation types, we are changing how retention policies are applied to 1:1 direct messages with external participants.


Following this change, 1:1 direct messages with external participants will respect the retention policy of the user who created the conversation. If a user in your organization did not create the conversation, they may see more or fewer messages in the Chat user interface after this change since the creator’s policy will be respected. You can see who created the conversation by scrolling to the top of the conversation, or hovering over the external badge. 


This change does not impact an admin’s ability to apply a retention policy or ability to access 1:1 direct messages in Google Vault or Data Export for users with a Google Vault policy applied. 


If you do not have Vault, or do not have a Vault policy applied, changes in access to conversations will apply to the product user interface and Data Export.


Additionally, today, in the case that two users within the same organization have conflicting retention or auto-deletion policies, we respect those policies separately for each user. Once the migration happens, we will respect the longer of the two retention policies and the shorter of the two auto-deletion policies for both users in the conversation. If one user has a custom retention rule while the other has only a default retention rule, the custom rule will take precedence over a default rule.


Starting May 1, 2025:
  • All new external 1:1 direct messages will respect the retention policy of the creator. 
    • For users with a Vault policy applied, the creator’s policy will only impact messages in the Chat product user interface. 

Starting June 2, 2025:
  • Existing 1:1 direct messages will migrate to respect the retention policy of the creator. 
    • For users with a Vault policy applied, the creator’s policy will only impact messages in the Chat product user interface. 

By August 1, 2025:
  • We anticipate the migration will be complete.

Until February 1, 2026:
  • We will preserve impacted 1:1 direct messages in Google Vault or Data Export for 6 months past the end of the migration to allow organizations to download a copy of the data.

Why it matters

It’s important to note that if your organization has a Google Vault policy applied to your users, you will not lose access to any conversations—even if they no longer appear in the Chat product user interface. If your organization does not have Vault or does not have a Vault policy applied, some conversations that were previously available may no longer be available in Data Export or Vault. 


Getting started

Resources

Get Ready for Search Central Live Asia Pacific 2025

Hello 2025! (Yeah, we know, time flies!) We've had some exciting plans in the works for Search Central Live (SCL) Asia Pacific this year, and we're super excited to let you in on what we've been up to. We've been listening closely to your feedback, and we're cooking up something different than what we usually do–something bigger, deeper, and more tailored to you!